Make PostgreSQL sslmode configurable via environment variable
- Ngôn ngữ chính
- Go
- Star
- 1.2k
- Fork
- 69
- Chỉ số merge pull request
- Không có pull request nào được merge trong 30 ngày
Mô tả
**Is your feature request related to a problem? Please describe.**
Yes. When deploying Peekaping in production environments or cloud infrastructure with strict security policies, the hardcoded sslmode=disable for PostgreSQL connections is a significant security concern. Many organizations require SSL/TLS encryption for all database connections to comply with security standards and regulations (e.g., PCI-DSS, HIPAA, SOC 2). Currently, there is no way to enable SSL/TLS for PostgreSQL connections without modifying the source code, which makes it difficult to meet these requirements.
**Describe the solution you'd like**
Add support for configuring PostgreSQL SSL mode through an environment variable, such as `DB_SSLMODE`. This environment variable should:
1. Accept standard PostgreSQL sslmode values: `disable`, `allow`, `prefer`, `require`, `verify-ca`, `verify-full`
2. Default to `disable` for backward compatibility
3. Be applied to all PostgreSQL connections (main database connection, migrations, health checks)
4. Be documented in the development guide and Docker configuration examples
Example implementation:
```env
DB_TYPE=postgres
DB_HOST=localhost
DB_PORT=5432
DB_NAME=peekaping
DB_USER=root
DB_PASS=password
DB_SSLMODE=require
```
**Describe alternatives you've considered**
1. **Hardcode sslmode in connection string during deployment** - Not viable as it requires code modification or complex environment variable substitution
2. **Use Docker secrets for sensitive SSL configuration** - Only addresses certificate handling, not the sslmode parameter itself
3. **Modify source code before deployment** - Time-consuming, error-prone, and violates infrastructure-as-code principles
4. **Use a proxy/wrapper for PostgreSQL connections** - Adds complexity and performance overhead
**Additional context**
* Currently hardcoded locations: `apps/server/internal/infra/sql.go` and `apps/server/cmd/bun/main.go`
* Health check PostgreSQL executor already parses sslmode from connection strings, but the main database connection does not respect environment variables
* This feature aligns with the principle of configuration management and would make Peekaping more enterprise-ready
* Many competing projects (e.g., other Go-based monitoring tools) already support this configuration
Hướng dẫn đóng góp
Chưa lập chỉ mục được hướng dẫn đóng góp cho kho mã nguồn này
Hướng nghiên cứu
The issue mentions two files: `apps/server/internal/infra/sql.go` and `apps/server/cmd/bun/main.go`. Start by examining how the PostgreSQL connection is currently configured in these files. Look for where the connection string is built and where `sslmode=disable` is hardcoded. You'll need to read the existing configuration parsing logic to understand how to integrate a new `DB_SSLMODE` environment variable. The goal is to make the sslmode configurable, defaulting to 'disable', and ensure it applies to all PostgreSQL connections. Check for any existing tests related to database configuration.
Do mô hình lập chỉ mục viết ra từ nội dung của issue.
Đánh giá
- Công nghệ
- go, postgresql
- Lĩnh vực
- backend, databases
- Loại issue
- Tính năng
- Độ khó
- 3/5
- Thời gian dự kiến
- 1-2 ngày
- Mức độ hoạt động
- Đình trệ
- Độ rõ ràng
- Đặc tả rõ ràng
- Mức phù hợp với người mới
- 55/100